ABP框架源碼學習之授權邏輯

asp.net core的默認的幾種授權方法參考“雨夜朦朧”的系列博客，這里要強調的是asp.net core mvc中的授權和asp.net mvc中的授權不一樣，建議先看前面“雨夜朦朧”的博客。

Abp中Controller里面用到的權限驗證類為：AbpMvcAuthorizeAttribute，ApplicationService里面用到的權限驗證類為：AbpAuthorizeAttribute（見下圖）。

AbpMvcAuthorizeAttribute和AbpAuthorizeAttribute這兩個類全部繼承自IAbpAuthorizeAttribute（重要！！！），下面是這兩個類的源碼。

namespace Abp.Authorization
{
    /// <summary>
    /// This attribute is used on a method of an Application Service (A class that implements <see cref="IApplicationService"/>)
    /// to make that method usable only by authorized users.
    /// </summary>
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
    public class AbpAuthorizeAttribute : Attribute, IAbpAuthorizeAttribute
    {
        /// <summary>
        /// A list of permissions to authorize.
        /// </summary>
        public string[] Permissions { get; }

        /// <summary>
        /// If this property is set to true, all of the <see cref="Permissions"/> must be granted.
        /// If it's false, at least one of the <see cref="Permissions"/> must be granted.
        /// Default: false.
        /// </summary>
        public bool RequireAllPermissions { get; set; }

        /// <summary>
        /// Creates a new instance of <see cref="AbpAuthorizeAttribute"/> class.
        /// </summary>
        /// <param name="permissions">A list of permissions to authorize</param>
        public AbpAuthorizeAttribute(params string[] permissions)
        {
            Permissions = permissions;
        }
    }
}

namespace Abp.AspNetCore.Mvc.Authorization
{
    /// <summary>
    /// This attribute is used on an action of an MVC <see cref="Controller"/>
    /// to make that action usable only by authorized users. 
    /// </summary>
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
    public class AbpMvcAuthorizeAttribute : AuthorizeAttribute, IAbpAuthorizeAttribute
    {
        /// <inheritdoc/>
        public string[] Permissions { get; set; }

        /// <inheritdoc/>
        public bool RequireAllPermissions { get; set; }

        /// <summary>
        /// Creates a new instance of <see cref="AbpMvcAuthorizeAttribute"/> class.
        /// </summary>
        /// <param name="permissions">A list of permissions to authorize</param>
        public AbpMvcAuthorizeAttribute(params string[] permissions)
        {
            Permissions = permissions;
        }
    }
}

重點來啦！！！

 

namespace Abp.AspNetCore.Mvc.Authorization
{
    public class AbpAuthorizationFilter : IAsyncAuthorizationFilter, ITransientDependency
    {
        public ILogger Logger { get; set; }

        private readonly IAuthorizationHelper _authorizationHelper;
        private readonly IErrorInfoBuilder _errorInfoBuilder;
        private readonly IEventBus _eventBus;

        public AbpAuthorizationFilter(
            IAuthorizationHelper authorizationHelper,
            IErrorInfoBuilder errorInfoBuilder,
            IEventBus eventBus)
        {
            _authorizationHelper = authorizationHelper;
            _errorInfoBuilder = errorInfoBuilder;
            _eventBus = eventBus;
            Logger = NullLogger.Instance;
        }

        public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
        {
            // 判斷context中是否有繼承IAllowAnoymousFilter,有則跳出方法即驗證成功
            if (context.Filters.Any(item => item is IAllowAnonymousFilter))
            {
                return;
            }
　　　　　　　//判斷是否是Controller，具體方法見下面第一張截圖
            if (!context.ActionDescriptor.IsControllerAction())
            {
                return;
            }

            //TODO: Avoid using try/catch, use conditional checking
            try
            {
                await _authorizationHelper.AuthorizeAsync(
                    context.ActionDescriptor.GetMethodInfo(),
                    context.ActionDescriptor.GetMethodInfo().DeclaringType
                );
            }
            catch (AbpAuthorizationException ex)
            {
                Logger.Warn(ex.ToString(), ex);

                _eventBus.Trigger(this, new AbpHandledExceptionData(ex));

                if (ActionResultHelper.IsObjectResult(context.ActionDescriptor.GetMethodInfo().ReturnType))
                {
                    context.Result = new ObjectResult(new AjaxResponse(_errorInfoBuilder.BuildForException(ex), true))
                    {
                        StatusCode = context.HttpContext.User.Identity.IsAuthenticated
                            ? (int) System.Net.HttpStatusCode.Forbidden
                            : (int) System.Net.HttpStatusCode.Unauthorized
                    };
                }
                else
                {
                    context.Result = new ChallengeResult();
                }
            }
            catch (Exception ex)
            {
                Logger.Error(ex.ToString(), ex);

                _eventBus.Trigger(this, new AbpHandledExceptionData(ex));

                if (ActionResultHelper.IsObjectResult(context.ActionDescriptor.GetMethodInfo().ReturnType))
                {
                    context.Result = new ObjectResult(new AjaxResponse(_errorInfoBuilder.BuildForException(ex)))
                    {
                        StatusCode = (int) System.Net.HttpStatusCode.InternalServerError
                    };
                }
                else
                {
                    //TODO: How to return Error page?
                    context.Result = new StatusCodeResult((int)System.Net.HttpStatusCode.InternalServerError);
                }
            }
        }
    }
}

 

 

AbpAuthorizationFilter繼承自IAsyncAuthorizationFilter和ITransientDependency，其中繼承自ITransientDependency 是為了注入這個類，繼承IAsyncAuthorizationFilter這個接口下面會寫到。

其中AbpAuthorizationFilter類的OnAuthorizationAsync這個方法是驗證授權的最重要的一個地方，其中_authorizationHelper.AuthorizeAsync是通過反射得到是否有繼承自 IAbpAuthorizeAttribute 接口的特性，即AbpMvcAuthorizeAttribute和AbpAuthorizeAttribute，然后得到這個特性標識的權限，然后PermissionChecker檢驗用戶是否具有這個權限。

 

現在我們知道AbpAuthorizationFilter的主要任務就是通過判斷controller或者service的標識的權限對比用戶是否具有這個權限來達到授權驗證。那AbpAuthorizationFilter怎么觸發的呢，也就是什么時候調用的呢，，從下圖我們可以看出當我們調用AddAbp這個方法時，也就是在Startup類里面調用AddAbp時，就會在MvcOptions里面FilterCollection里面添加AbpAuthorizationFilter，當我們訪問一個Controller或者ApplicationService時就會觸發這個filter，判斷權限。

拓展：當我們有某個業務需要用到AOP時，但又不想使用一些第三方框架，我們就可以借鑒上面的方法，定義一個特性，然后定義一個Filter，在Filter里面判斷Controller等是否使用這些特性，並且特性的屬性是否符合我們的需求，最后在Startup里面AddMvc時將這個Filter添加到FilterCollection里面。例如下圖，自動驗證AntiforgeryToken